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PRELIMINARY AMENDMENT 


^^Commissioner for Patents 
j%ashington, DC 20231 

ifiDear Sir: 


^ Prior to substantive Examination of the above-identified patent application, please enter the 
following amendments. 


IN THE TITLE: 

Please delete the TITLE OF THE INVENTION, and insert a new TITLE OF THE 
INVENTION as set forth hereinbelow: 

-SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR REPORTING IN A 
NETWORK-BASED FILTERING AND AGGREGATING PLATFORM-. 


IN THE SUMMARY: 
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Please delete the SUMMARY OF THE INVENTION, and insert a new SUMMARY OF 
THE INVENTION as set forth hereinbelow: (See Appendix A) 

A system with accompanying method and computer program product are provided for 
reporting on the collection of network usage information from a plurality of network devices. 
Included is a plurality of information source modules for collecting network communications usage 
information in real-time from a plurality of network devices. Gatherers are coupled to the 
information source modules for filtering and aggregating the network communications usage 
information. Coupled to the gatherers is a central event manager. The central event manager is 
adapted for completing a pluraUty of data records from the filtered and aggregated network 
communications usage information. The data records correspond to network usage by a plurality of 
users. Also included is a database coupled to the central event manager for storing the plurality of 
^gdata records. Logic is provided for allowing the selection of one of a plurality of reports for 
J J^reporting purposes, submitting queries to the database utihzing the selected reports for retrieving 
Iflinformation on the collection of the network usage information fi-om the network devices, and 
lljoutputting a report based on the queries. 

h IN THE ABSTRACT: 

CO 
fO 

Please delete the ABSTRACT OF THE INVENTION, and insert a new ABSTRACT OF 
J JtHE invention as set forth hereinbelow: (See Appendix B) 

A system with accompaaying method and computer program product are provided for reporting on 
the collection of network usage information from a plurality of network devices. Included is a 
plurality of information source modules for collecting network communications usage information in 
real-time from a plurality of network devices. Gatherers are coupled to the information source 
modules for filtering and aggregating the network communications usage information. Coupled to 
the gatherers is a central event manager. The central event manager is adapted for completing a 
pluraUty of data records from the filtered and aggregated network communications usage 
information. The data records correspond to network usage by a plurahty of users. Also included is 
a database coupled to the central event manager for storing the plurality of data records. Logic is 
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provided for allowing the selection of one of a plurality of reports for reporting purposes, submitting 
queries to the database utilizing the selected reports for retrieving information on the collection of 
the network usage information from the network devices, and outputting a report based on the 
queries. 

IN THE CLAIMS: 

Please cancel claims 1-31, and add claims 32-49, as follows: 

32. A method for reporting on the collection of network usage information from a 
plurality of network devices, comprising: 

.J^ collecting network communications usage information in real-time from a plurality of 
network devices; 

lJ|b) filtering and aggregating the network communications usage information; 
life) completing a phirahty of data records from the filtered and aggregated network 
ly conmnmications usage information, the plurality of data records corresponding to network 
usage by a plurality of users; 

Qd) storing the phirality of data records in a database; 

Ifl 

|0e) allowing the selection of one of a plurality of reports for reporting purposes; 

f Jf) submitting queries to the database utilizing the selected reports for retrieving information on 

|4 the collection of the network usage information from the network devices; and 

(g) outputting a report based on the queries, 

33. A method as recited in claim 32, and further comprising submitting network activity 
queries to the database utilizing the selected reports for retrieving information on activity of the 
network. 

34. A method as recited in claim 33, and fiirther comprising outputting a network activity 
report based on the network activity queries. 
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35. A method as recited in claim 32, and further comprising submitting resource 
consumption queries to the database utihzing the selected reports for retrieving information on 
resource consumption in the network. 

36. A method as recited in claim 33 , and further comprising outputting a resource 
consumption report based on the resource consumption queries. 

37. A method as recited in claim 33, and further comprising generating an alert upon the 
occurrence of an event. 

A method as recited in claim 37, wherein the alert is generated upon a value 
a predetermined amount. 

A method as recited in claim 37, wherein the alert indicates that services should be 

A method as recited in claim 37, wherein the alert indicates that services should be 

A method as recited in claim 32, wherein the report includes an auditing report. 
A method as recited in claim 32, wherein the report includes a billing report. 

43. A method as recited in claim 32, wherein the report includes an accounting report. 

44. A computer program product for reporting on the collection of network usage 
information from a plurality of network devices, comprising: 

(a) computer code for collecting network communications usage information in real-time from a 
plurality of network devices; 

(b) computer code for filtering and aggregating the network communications usage information; 
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(c) computer code for completing a plurality of data records from the filtered and aggregated 
network communications usage information, the pluraUty of data records corresponding to 
network usage by a plurality of users; 

(d) computer code for storing the plurality of data records in a database; 

(e) computer code for allowing the selection of one of a plurality of reports for reporting 
purposes; 

(f) computer code for submitting queries to the database utilizing the selected reports for 
retrieving information on the collection of the network usage information from the network 
devices; and 

(g) computer code for outputting a report based on the queries. 

45. A system for reporting on the collection of network usage information from a 
pplurality of network devices, comprising: 

.'S(a) information source modules for collecting network communications usage information in 
^ j real-time from a plurality of network devices; 

i4(b) gatherers coupled to the information source modules, the gatherers adapted for filtering and 
' S aggregating the network communications usage information; 

f (c) a central event manager coupled to the gatherers, the central event manager adapted for 
m completing a pluraUty of data records from the filtered and aggregated network 

communications usage information, the plurality of data records corresponding to network 
13 usage by a pluraUty of users; 

(d) a database coupled to the central event manager, the database adapted for storing the pluraUty 
of data records; and 

(e) logic for allowing the selection of one of a plurality of reports for reporting purposes, 
submitting queries to the database utilizing the selected reports for retrieving information on 
the collection of the network usage information from the network devices, and outputting a 
report based on the queries. 

46. A method for reporting on the collection of network usage information from a 
plurality of network devices, comprising: 
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(a) collecting network communications usage information in real-time from network devices at a 
plurality of layers utilizing multiple gatherers each including a plurality of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto, the network devices selected 
from the group consisting of routers, switches, firewalls, authentication servers, web hosts, 
proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name 
servers, the gatherers being positioned on a segment of the network on which the network 
devices coupled thereto are positioned for minimizing an impact of the gatherers on the 
network; 

(b) translating the network communications usage information collected from the network 
devices utilizing the information source modules; 

(c) caching the network communications usage information collected from the network devices 
Q utilizing the gatherers; 

-p(d) normalizing the network communications usage information with the gatherers by excluding 
J 2 fields not required by a central event manager coupled to the gatherers; 

f ^(e) defining an enhancement procedure utilizing the central event manager; 

fll 

lpk(f) coordinating the collection of the network commxmications usage information by the 
l^^^ gatherers utihzing the central event manager; 

fi(g) filtering the network communications usage information utilizing the central event manager; 
I J(h) completing a plurahty of data records from the filtered network conanmnications usage 
l3 information, the plurahty of data records corresponding to network usage by a plurality of 

users; 

(i) aggregating the network communications usage information and the data records utilizing the 

central event manager for reducing a number of the data records; 
(j) enhancing the aggregation of the network communications usage information with the 

gatherers in accordance with the defined enhancement procedure; 
(k) time stamping the data records; 

(1) storing the time stamped data records in tables in a central database coupled to the central 

event manager at a user-specified interval; 
(m) deleting the stored data records upon the cessation of a predetermined amount of time after 

the storage utilizing the timestamp; 
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(n) periodically determining whether the network devices are currently licensed; 

(o) submitting network activity queries to the central database for retrieving information on 

activity of the network; 
(p) outputting a network activity report based on the network activity queries; 
(q) submitting resource consumption queries to the central database for retrieving information on 

resource consumption in the network; 
(r) outputting a resource consumption report based on the resource consumption queries; and 
(s) generating an alert upon the occurrence of an event utiUzing the information source modules. 

47. A method as recited in claim 46, wherein the alert is generated upon a value 
surpassing a predetermined amount. 

\ 48. A method as recited in claim 46, wherein the alert indicates that services should be 
f^ceased. 

49. A method as recited in claim 46, wherein the alert indicates that services should be 
^provided. 

fl REMARKS 

The claims of the present application have been amended to include subject matter clearly 
.^disclosed in the originally filed specification. No new matter has been added. 

Li the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 505-5 100. For payment of the fees due in connection 
with the filing of this paper, the Commissioner is authorized to charge such fees to Deposit Account 
No. 50-1351 (Order No. XACTP014A). A duphcate copy of the transmittal is enclosed for this 
purpose. . 

Res^eSffujrf/sxfq^ 

P.O. Box 721120 
San Jose, CA 95172-1120 
408-505-5100 
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